Refuse ignored vendor roots before takeover

Review follow-ups for #1061:

- jvm_gate_preflight now also refuses vendor_artifact_gitignored when
  git ignores a JVM tree root. It runs before a hosted->vendored
  takeover restores upstream, so a Gradle pin (whose hosted index the
  group commit can't roll back) stays hosted instead of ending neither
  hosted nor vendored.
- NuGet checks the ignored uuid dir before the empty-patch success
  return, so an empty patch can't report success under a .socket/
  rule.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-core/src/vendor/maven_repo.rs

@@ -562,8 +562,29 @@ pub async fn jvm_gate_preflight(
     }
     let shape = detect_shape(project_root);
     super::jvm::sbt_gate::for_shape(shape, project_root, &g, &a, &v)
-        .map(|_| ())
-        .map_err(|stop| stop.code_and_detail(purl))
+        .map_err(|stop| stop.code_and_detail(purl))?;
+    // Checked here too, so a hosted->vendored takeover keeps its pin
+    // instead of restoring upstream and then refusing (#1061).
+    match ignored_tree_root(shape, project_root).await {
+        Some(refusal) => Err(refusal),
+        None => Ok(()),
+    }
+}
+
+/// The `vendor_artifact_gitignored` refusal when git ignores a tree root
+/// `shape` writes into. Each tree root owns a `!*` `.gitignore` that
+/// re-includes file rules such as Java.gitignore's `*.jar` (#1061), but a
+/// rule ignoring the root itself (`.socket/`) can't be undone from inside.
+async fn ignored_tree_root(
+    shape: super::jvm::Shape,
+    project_root: &Path,
+) -> Option<(&'static str, String)> {
+    for tree in super::jvm::shape_trees(shape) {
+        if let Some(refusal) = super::npm_dir::ignored_root_refusal(project_root, tree).await {
+            return Some(refusal);
+        }
+    }
+    None
 }
 
 /// The committed tree bytes for `record` (jar, upstream pom, module, and
@@ -697,13 +718,8 @@ async fn jvm_prelude(
         super::jvm::sbt_gate::for_shape(shape, project_root, &group_id, &artifact_id, &version)
             .map_err(|stop| stop.into_outcome(purl))?;
     // The tree must survive the commit the vendored workflow ends with.
-    // Each tree root owns a `!*` `.gitignore` that re-includes file rules
-    // such as Java.gitignore's `*.jar` (#1061), but a rule ignoring the
-    // root itself (`.socket/`) can't be undone from inside it.
-    for tree in super::jvm::shape_trees(shape) {
-        if let Some(refusal) = super::npm_dir::ignored_root_refusal(project_root, tree).await {
-            return Err(refusal);
-        }
+    if let Some((code, detail)) = ignored_tree_root(shape, project_root).await {
+        return Err(refused(code, detail));
     }
     Ok(JvmPrelude {
         group_id,
@@ -2032,6 +2048,12 @@ mod tests {
                         before,
                         "{shape} {rule}: nothing written"
                     );
+                    // The takeover gate refuses too, before any restore.
+                    assert_eq!(
+                        jvm_gate_preflight(root, PURL).await.map_err(|(c, _)| c),
+                        Err("vendor_artifact_gitignored"),
+                        "{shape} {rule}"
+                    );
                 }
             }
         }

crates/socket-patch-core/src/vendor/npm_dir.rs

@@ -508,17 +508,18 @@ fn gitignored_refusal(rel_dir: &str, rules: &str) -> VendorOutcome {
     refused(GITIGNORED, gitignored_detail(rel_dir, rules))
 }
 
-/// The `vendor_artifact_gitignored` refusal for a vendored artifact root
-/// (`dir_rel`, project-relative) that git ignores as a directory: a
-/// `.socket/` or `.socket/vendor/` rule no `.gitignore` inside the root can
-/// override (#831, #1061). `None` when git would look inside it, so the
-/// root's own `!*` `.gitignore` re-includes file rules such as `*.jar`.
+/// The `vendor_artifact_gitignored` refusal (code, detail) for a vendored
+/// artifact root (`dir_rel`, project-relative) that git ignores as a
+/// directory: a `.socket/` or `.socket/vendor/` rule no `.gitignore` inside
+/// the root can override (#831, #1061). `None` when git would look inside
+/// it, so the root's own `!*` `.gitignore` re-includes file rules such as
+/// `*.jar`.
 pub(crate) async fn ignored_root_refusal(
     project_root: &Path,
     dir_rel: &str,
-) -> Option<VendorOutcome> {
+) -> Option<(&'static str, String)> {
     let rules = gitignored(project_root, &[format!("{dir_rel}/")]).await?;
-    Some(gitignored_refusal(dir_rel, &rules))
+    Some((GITIGNORED, gitignored_detail(dir_rel, &rules)))
 }
 
 pub(crate) const GITIGNORED: &str = "vendor_artifact_gitignored";

crates/socket-patch-core/src/vendor/nuget_feed.rs

@@ -221,6 +221,14 @@ async fn nuget_prelude(
     let nupkg_path = project_root.join(&copy_rel);
     let source_key = crate::patch::redirect::generation::hosted_pin_name(&record.uuid);
 
+    // The nupkg must survive the commit the vendored workflow ends with: a
+    // rule ignoring the uuid dir itself can't be undone from inside it.
+    if let Some((code, detail)) =
+        super::npm_dir::ignored_root_refusal(project_root, &uuid_dir_rel).await
+    {
+        return Err(refused(code, detail));
+    }
+
     // A patch with no files is meaningless to vendor: no-op success, no edits.
     if record.files.is_empty() {
         return Err(done(
@@ -230,12 +238,6 @@ async fn nuget_prelude(
         ));
     }
 
-    // The nupkg must survive the commit the vendored workflow ends with: a
-    // rule ignoring the uuid dir itself can't be undone from inside it.
-    if let Some(refusal) = super::npm_dir::ignored_root_refusal(project_root, &uuid_dir_rel).await {
-        return Err(refusal);
-    }
-
     let config_path = existing_config_path(project_root).await;
     let config_text: Option<String> = match &config_path {
         Some(p) => match read_regular_to_string(p).await {
@@ -2501,6 +2503,12 @@ mod tests {
                     tokio::fs::read(root.join(PACKAGES_LOCK)).await.unwrap(),
                     lock_before
                 );
+                // An empty patch is refused too, never a calm success.
+                let mut empty = record.clone();
+                empty.files.clear();
+                let (code, _) =
+                    unwrap_refused(run_vendor(root, &blobs, &installed, &empty, dry_run).await);
+                assert_eq!(code, "vendor_artifact_gitignored", "{rule}: empty patch");
             }
         }
     }